diff --git a/data_source/endpoint/sysmon_event_code_1.yml b/data_source/endpoint/sysmon_event_code_1.yml new file mode 100644 index 0000000000..8b5e82ced9 --- /dev/null +++ b/data_source/endpoint/sysmon_event_code_1.yml @@ -0,0 +1,54 @@ +name: Sysmon Event Code 1 +id: 035d5583-8d20-4b85-b4fc-a0a8ced1f2f4 +version: 1 +date: '2022-07-05' +author: Patrick Bareiss, Splunk +description: The process creation event provides extended information about a newly + created process. The full command line provides context on the process execution. + The ProcessGUID field is a unique value for this process across a domain to make + event correlation easier. The hash is a full hash of the file with the algorithms + in the HashType field. +platform: windows +log_source: sysmon +supported_TA: + - Splunk_TA_microsoft_sysmon +references: + - https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation +event_fields: + - name: ProcessGuid + description: Process Guid of the process that got spawned/created + sample_value: '{A98268C1-9C2E-5ACD-0000-0010396CAB00}' + cim_mapping: process_guid + ossem_mapping: + - name: ProcessId + description: Process Id of the process that got spawned/created + sample_value: '2134' + cim_mapping: process_id + ossem_mapping: +... +sample_event: |- + +- +2021-11-03 04:38:27.500 +{3710b5c6-1243-6182-8303-000000000a00} +4044 +C:\Windows\System32\notepad.exe +10.0.19041.1081 (WinBuild.160101.0800) +Notepad +Microsoft® Windows® Operating System +Microsoft Corporation +NOTEPAD.EXE +"C:\Windows\system32\notepad.exe" +C:\Users\pedro\ +DESKTOP-4FPBTEN\pedro +{3710b5c6-f53c-6181-cabe-120000000000} +0x12beca +1 +Medium +SHA1=66B6158B28CC2B970E454B6A8CF1824DD99E4029,MD5=1C1760ED4D19CDBECB2398216922628B,SHA256=D66458A3EB1B68715B552B3AF32A9D2E889BBF8AC0C23C1AFA8D0982023D1CE2,IMPHASH=670212BD5FAE78855C331EDDEFFDD4EB +{3710b5c6-f548-6181-8c01-000000000a00} +4292 +C:\Windows\explorer.exe +C:\Windows\Explorer.EXE +DESKTOP-4FPBTEN\pedro + \ No newline at end of file diff --git a/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml b/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..6c121ebfb3 --- /dev/null +++ b/detections/endpoint/00_detection_wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,72 @@ +name: Wevtutil Usage To Disable Logs +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +version: 2 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +type: TTP +status: production +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. +logsource: + - Windows Security 4688 + - Sysmon Event Code 1 + - Carbon Black Process +search: + selection: + CommandLine|contains: 'sl' + CommandLine|contains: '/e:false' + Image|endswith: 'wevtutil.exe' + condition: selection +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: network operator may disable audit event logs for debugging + purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + confidence: 90 + impact: 70 + message: message here + drilldown: drilldown search here (pre generated) (optional field) + mitre_attack_id: + - T1070 + - T1070.001 + product: + - Splunk Behavioral Analytics + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 63 + risk_severity: medium + security_domain: endpoint + asset_type: Endpoint +test: +- name: Wevtutil Usage To Disable Logs SRS + product: BA + pass_condition: '@count_gt(0)' + attack_data: + - file_name: disable_evt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + source: WinEventLog:Security +- name: Wevtutil Usage To Disable Logs Sysmon + product: ESCU + pass_condition: '@count_gt(0)' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: Wevtutil Usage To Disable Logs CarbonBlack + product: ESCU + pass_condition: '@count_gt(0)' + attack_data: + - file_name: carbon-black.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/carbon-black.log + sourcetype: cb:events \ No newline at end of file diff --git a/detections/endpoint/00_srs_wevtutil_usage_to_disable_logs.yml b/detections/endpoint/00_srs_wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..f94fc8ee9c --- /dev/null +++ b/detections/endpoint/00_srs_wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,63 @@ +name: Wevtutil Usage To Disable Logs +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +version: 2 +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") + AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: network operator may disable audit event logs for debugging + purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + cis20: + - CIS 8 + - CIS 13 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1070 + - T1070.001 + nist: + - PR.DS + - PR.IP + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + risk_score: 63 + security_domain: endpoint + risk_severity: medium +test: + name: Wevtutil Usage To Disable Logs Unit Test + tests: + - name: Wevtutil Usage To Disable Logs + file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: disable_evt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + source: WinEventLog:Security diff --git a/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml b/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml new file mode 100644 index 0000000000..74b3121108 --- /dev/null +++ b/detections/endpoint/00_wevtutil_usage_to_disable_logs.yml @@ -0,0 +1,117 @@ +name: Wevtutil Usage To Disable Logs +id: a4bdc944-cdd9-11eb-ac97-acde48001122 +version: 2 +date: '2021-06-15' +author: Teoderick Contreras, Splunk +type: TTP + +<---Remove---> +datamodel: +- Endpoint_Processes + +description: This search is to detect execution of wevtutil.exe to disable logs. This + technique was seen in several ransomware to disable the event logs to evade alerts + and detections in compromised host. + +<---Remove---> +search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels) + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, + "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), + "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") + AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, + entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, + "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, + "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, + "process_path", process_path]) | into write_ssa_detected_events();' + +logsource: -> data source object: defines inputs, outputs, needed TAs, description, normalied fields by schema (OCSF, CIM) + product: windows + catgeory: process_creation +search: + selection: + CommandLine|contains: 'sl' + CommandLine|contains: '/e:false' + Image|endswith: 'wevtutil.exe' + condition: selection + +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. +known_false_positives: network operator may disable audit event logs for debugging + purposes. +references: +- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + + <---Remove---> Is automatically derived from logsource field + cis20: + - CIS 8 + - CIS 13 + + confidence: 90 + impact: 70 + + <--- Completely Remove It---> + context: + - Source:Endpoint + - Stage:Defense Evasion + + <---Remove---> + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log + + <---Remove---> Is automatically derived based on Mitre Attack Information + kill_chain_phases: + - Exploitation + + message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable + event logs in host $dest_device_id$ + + mitre_attack_id: + - T1070 + - T1070.001 + + <---Remove---> Is automatically derived from logsource field + nist: + - PR.DS + - PR.IP + + <---Remove---> Output is standardized based on logsource + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + + product: + - Splunk Behavioral Analytics + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + + <---Remove---> Is automatically derived from logsource field + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + + risk_score: 63 + risk_severity: medium + security_domain: endpoint + asset_type: Endpoint